v2

latestOpenAPI 3.1.02026-07-262279731.3 MB

cardRegistrations

Tokenize the card

Send card details to a PCI-DSS-compliant tokenization server without reaching Mangopay’s servers.

The URL to use for this endpoint is returned in the CardRegistrationURL parameter on the POST Create a Card Registration endpoint.

The request must be made using the “application/x-www-form-urlencoded” content type. <Note icon="fa-regular fa-circle-info"> Note – Do not hardcode the URL

The CardRegistrationURL is specific to each payment. You must rely on the returned URL in full (host, path, and queries) and not hardcode any part of it. </Note>

<Warning icon="fa-regular fa-triangle-exclamation"> **Caution – Card details must never pass via your server**

For security reasons, it is strictly forbidden to send the card details to your own server. You must rely on the dedicated PCI-DSS-compliant tokenization server by using the endpoint provided. </Warning>

post/{CardRegistrationUrl}

Path parameters

CardRegistrationUrlstring required

The variable URL is only documented as a path parameter on this path for documentation reasons. I allows it to be rendered visiablly on the page, and because there are two dynamic server URLs in the spec (so both would be on the / path). The variable URL is the server for this request, and it has a variable host and path and query parameters. You do not need to add anything to it.

Headers

Authorizationstring required

Bearer authentication of the form Bearer <token>, where token is your auth token.

If your platform is using a proxy to take SCA-triggering action on behalf of users, you also need to integrate mTLS authentication and use the api-mtls base URL.

Request body

accessKeyRefstring required

The AccessKey returned by the POST Create a Card Registration call.

datastring required

The PreregistrationData returned by the POST Create a Card Registration call.

cardNumberstring required

The full PAN (card number) of the card.

cardExpirationDatestring required

The expiration date of the card in MMYY format, for example: 1229.

cardCvxstring required

The card verification code (CVC) or card verification value (CVV), typically 3 digits found on the back of the card.

AMEX codes are 4 digits and are called card identification (CID) numbers.

For cards that don’t have a CVC, such as Maestro, use 000 or 999.

Response

The string returned by the tokenization server.

Send this string in full as the RegistrationData value on the PUT Update a Card Registration endpoint to create the Card object.

object required